Fix crash by focusing multiple-fields input types during a unload event.
ContainerNode::removeChildren:
We should remove focus after dispatching unload events. Document::
m_focusedNode could have an element not in the document tree.
Document::implicitOpen:
Confirm that removeChildren clears m_focusedNode.
BaseMultipleFieldsDateAndTimeInputType::didBlurFromControl:
Protect element() because it might loose the last reference by
setFocus(false).
BUG=249640
Review URL: https://chromiumcodereview.appspot.com/17577013
git-svn-id: svn://svn.chromium.org/blink/trunk@152990 bbb929c8-8fbe-4397-9dbb-9b2b20218538

@@ -556,9 +556,6 @@
// The container node can be removed from event handlers. RefPtr<ContainerNode> protect(this);- // exclude this node when looking for removed focusedNode since only children will be removed- document()->removeFocusedNodeOfSubtree(this, true);- if (FullscreenController* fullscreen = FullscreenController::fromIfExists(document())) fullscreen->removeFullScreenElementOfSubtree(this, true);@@ -566,6 +563,12 @@
// and remove... e.g. stop loading frames, fire unload events. willRemoveChildren(protect.get());+ // Exclude this node when looking for removed focusedNode since only+ // children will be removed.+ // This must be later than willRemvoeChildren, which might change focus+ // state of a child.+ document()->removeFocusedNodeOfSubtree(this, true);+ NodeVector removedChildren; { WidgetHierarchyUpdatesSuspensionScope suspendWidgetHierarchyUpdates;